How to Edit the Standard Object Permissions for Leads inside the Public Access settings for the site?

Question

I have a public website that needs to update [Edit] the Lead object,

The website [visual force] page works fine inside the organization,

But gives me a permission restriction on the public website,

The reason is that I need to check the Edit check box for the Standard Object Permissions for Leads inside the Public Access settings for the site,

And I can’t seem to find a way to do that!

By default only the Read and Create boxes are checked,

Does anyone know why or how to do that?

Answer 1

Exposing permissions in Public Access Settings for a site allows any anonymous website user to inherit that permission. I just want you to recognize that you're asking for anonymous users to be able to have the ability to edit your lead records. For obvious reasons, Salesforce does not allow this possible corruption of your CRM data. For this, you would need to use some type of external user license, like Partner Communities, to assign to any authenticated user to be able to add the Edit Leads permission.

Answer 2

As @greenstork mentions you do need to be careful with security on this and you should use practices to avoid SOQL injection and some of the Apex encoding functions to sanitize user input.

If you're providing some adequate security in this way there's a proposed workaround by Ken Koellner on Salesforce Success. He presents 2 possible workarounds:

1. Use input tags on your page not associated with the existing object. Then in your safe method in your controller, put the values in the sObject you want to update.
2. Cache the ID of the object(s) somewhere else, set it to null in the object, then during the save, replace the Id with the cached ID.

He has a code snippet on that article and indicates that he got it working, but a working code snippet hasn't been posted.